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30 March 2021 


Re: 2021 National Qualifications Appeals Process Consultation 


In advance of our meeting on 16 April 2021 to discuss the plans that the Scottish 
Qualifications Authority (SQA) are putting in place for appeals in 2021 in Scotland 
we are writing to you, having reviewed the consultation, to set out some 
reflections on the relevant data protection issues for your consideration. 


As well as monitoring and enforcing the UK General Data Protection Regulation 
CUK GDPR’) and Data Protection Act 2018 (‘DPA 2018’), the Information 
Commissioner's functions include promoting public awareness and understanding 
of the risks, rules, safeguards and rights in relation to the processing of personal 
data. 


This correspondence and any response received do not prejudice the potential 
future use of the Commissioner’s regulatory powers should any infringements of 
data protection law come to light. 


The appeals process 


It is the ICO’s understanding that the consultation relates to three varying 
models for the appeals process. The following advice is based on the proposals 
that have been outlined in the consultation. We would request that the SQA 
kindly notifies the ICO in the event of any significant changes to these proposals 
as our advice may need to be reviewed. 


Lawful basis 
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Organisations must ensure that they have identified a lawful basis for processing 
personal data. 


It is understood that special category personal data may be processed (as it is in 
a ‘normal’ year) as part of the appeals process. For example, the process for 
assessing and implementing reasonable adjustments will often involve 
consideration of data concerning health. If the adopted model for appeals 
arrangements in 2021 result in adaptations to normal procedures, data 
protection compliance measures will need to be reviewed to ensure special 
categories of personal data are processed compliantly and that both an Article 6 
and Article 9 condition are identified along with the relevant DPA 2018 provision 
if required. Further information regarding the processing of special category data 
can be found here. 


Transparency and Fairness 


Fairness and transparency are fundamental components of the data protection 
framework. Even if a lawful basis has been identified the processing of personal 
data must be fair. This means data controllers must not process personal data in 
a way that is unduly detrimental, unexpected or misleading to the individuals 
concerned. Ensuring that students are clear about the process and circumstances 
under which they are able to make an appeal will be key to ensuring fairness. 


We also note that provisional results will be given to students in advance of 
results day on 10 August 2021 meaning there will be a buffer between students 
receiving their provisional grades and those results being formalised for the 
purpose of university admissions and other onward opportunities. The ICO can 
see potential benefits in this approach in terms of the fairness of processing 
personal data though we note that this is primarily a matter for the SQA and 
other relevant bodies to consider. 


Students as data subjects have the right to be informed about the processing of 
their personal data which is intertwined with a data controller’s obligations 
around transparency. Ensuring that students are fully informed about the process 
by which to make an appeal will be key. We are aware of the guidance leaflet for 
students, which is welcomed (What you need to know for 2021 - National 5, 
Higher and Advanced Higher - SQA), and we would encourage SQA to update this 


or create a further more specific leaflet around the appeals process which would 
also support compliance with the UK GDPR. 
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Article 35 - Data Protection Impact Assessment (DPIA) 


As in previous academic years, the appeals process will involve the processing of 
personal data. UK GDPR Article 35 outlines when a DPIA should be undertaken 
and there are a range of processing activities where the ICO expect organisations 
to undertake a DPIA. A DPIA enables a systematic and comprehensive analysis of 
processing and helps to identify and minimise data protection risks. A good DPIA 
helps to evidence that risks related to the intended processing have been 
considered and that the broader data protection obligations have been met. 


SQA should consider whether it would need to undertake a DPIA in relation to the 
appeals process. 


Concluding comments 


We appreciate the complexity of the circumstances facing the SQA given the 
impact of the Covid-19 pandemic, as well as your responsibilities to deliver fair 
and high quality assessments and appeals for students seeking qualifications in 
2021. As indicated above, we would emphasise the importance of the data 
protection principles, in particular fairness and transparency, as well as 
undertaking a DPIA to assess the compliance of any planned processing of 
personal data. Should you wish to discuss any other matters of data protection 
policy with the ICO as you develop your plans, please get in touch. The ICO is 
also reviewing and intending to refresh as needed the guidance we put in for 
schools and colleges last year in relations to data subjects’ rights and the exam 
script exemption. 


I trust that this information is useful and we look forward to discussing the SQAs 
approach regarding the appeals process at the meeting in April. We also welcome 
any further discussion on any of the matters raised above should you have any 
further questions. 


For information about what we do with personal data see our privacy notice at 


www.ico.org.uk/privacy-notice 


